EUVD-2026-87367
GHSA-r7p3-q524-5mc7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocate exposed Flame instance
-
DeliveryScript POST /api/auth guesses
-
ExploitBypass absent rate-limiting/lockout
-
ExecutionRecover admin password
-
ImpactGain admin access and modify config
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Brute-force prevention, rate limiting
|
| Exploitation Conditions | No special configuration is required - remote unauthenticated exploitation works against default Flame installations because the POST /api/auth endpoint ships with no rate limiting, attempt counters, lockouts, or delays. The decisive limiting factor is admin password strength: since Flame uses a single admin password, a long/high-entropy password makes brute-force impractical (reflected in AC:H/AT:P), while a weak or default-style password is quickly recovered. Realistic risk is further limited by exposure - instances behind a VPN/reverse-proxy with its own auth, or on isolated LANs, are not remotely reachable. |
| Impact | Signals are moderately consistent but point to a targeted rather than mass-exploitation risk. The CVSS 4.0 vector (AV:N/PR:N/UI:N) confirms remote, unauthenticated reachability against the /api/auth endpoint, but AC:H and AT:P correctly reflect that success is conditional on the admin password being weak/guessable - the flaw removes rate-limiting/lockout guardrails but does not itself hand over access. Primary impact is integrity (VI:H = full admin takeover and config modification) with only minor confidentiality (VC:L) and no availability impact, which contradicts the input's 'Information Disclosure' tag. No EPSS score, no CISA KEV listing, and no public POC were provided; exploitation status is therefore 'no public exploit identified at time of analysis.' The 8.3 score is defensible but real-world urgency is tempered because impact hinges entirely on password entropy and because Flame is a niche self-hosted homelab product rather than an enterprise target. This is a genuine but lower-tier priority: real for internet-exposed instances with weak admin passwords, low for hardened or LAN-only deployments. |
| Exploit ScenarioDerived | An attacker discovers an internet-exposed Flame dashboard and scripts repeated POST /api/auth requests, cycling through a password wordlist. Because the endpoint enforces no rate limiting, attempt counters, lockouts, or delays, the attacker submits unlimited guesses at full speed until the single admin password is recovered, then logs in to modify application configuration. No public POC is referenced, though the technique is trivial to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Brute-force attacks against the POST /api/auth login endpoint in Flame through 2.4.0 let remote, unauthenticated attackers submit unlimited password guesses because the endpoint implements no rate limiting, attempt counters, delays, or lockouts. A successful guess yields full administrator access and the ability to modify application configuration. Exploitation requires network reachability to the instance and is only practical against weak or default-style admin passwords - a long, high-entropy password makes guessing impractical (reflected in AC:H/AT:P), and no public exploit code has been identified at time of analysis; instances behind a VPN, an authenticating reverse proxy, or on isolated LANs are not remotely reachable.
RemediationAI
No vendor-released patch has been identified at time of analysis, so remediation must initially be compensating controls while tracking the upstream repository (https://github.com/pawelmalak/flame) and issue #494 for a fixed release; if a patched version is published, upgrading past 2.4.0 is the definitive fix. The single most effective control is setting a long, randomly generated, high-entropy administrator password with no dictionary words or reused credentials - this directly addresses the AC:H/AT:P condition that makes exploitation impractical, and it carries no functional side effects. Second, stop exposing the login endpoint to untrusted networks: bind Flame to a private interface, place it behind a VPN or firewall allowlist, or front it with an authenticating reverse proxy (nginx basic auth, Authelia, oauth2-proxy, or client-certificate auth); the trade-off is that proxy-level authentication can break unauthenticated API or bookmarklet access and must be scoped so it does not conflict with Flame's own session handling. Third, add proxy/edge rate limiting and lockout where the application does not provide it - for example nginx limit_req/limit_conn on POST /api/auth, or fail2ban rules that ban source IPs generating repeated HTTP 401 responses; the trade-off is that aggressive thresholds can lock out legitimate users sharing a NAT egress IP, so tune thresholds and consider a short ban window with exponential backoff. Finally, monitor authentication logs for high-volume POST /api/auth requests or many 401s from a single source, which is the primary detection signal in the absence of application-side audit controls.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a classic CWE-307 (Improper Restriction of Excessive Authentication Attempts) flaw in Flame, a self-hosted personal dashboard/startpage application. Flame is a Node.js/Express web application whose authentication logic is centralized in the login controller referenced at controllers/auth/login.js (lines 11-22), routed through routes/auth.js (line 7) and exposed via the POST /api/auth endpoint; the supplied references also point to the project's Dockerfile (line 28) and an open project issue (#494) documenting the missing throttling behavior. Because the application maintains a single administrator credential rather than a multi-user account store, the entire authorization boundary collapses to the strength of one password. There is no per-IP or per-account attempt counter, no exponential backoff, no captcha, and no temporary or permanent lockout, so an attacker can iterate credentials at whatever rate the network and server permit. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N) indicates an unauthenticated network-reachable attack whose success depends on conditions outside the attacker's full control - namely password entropy and whether the instance is directly reachable - with high integrity impact (configuration modification) and low confidentiality impact; the independently assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N) is consistent with that reading.
Know when Node.js gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
Unauthenticated network endpoint (PR:N/AV:N), but success depends on guessing a weak password so AC:H; admin takeover gives I:H, config exposure only C:L, no availability impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
DescriptionCVE.org
Flame through 2.4.0 contains an improper restriction of excessive authentication attempts vulnerability in the POST /api/auth login endpoint that allows unauthenticated attackers to brute-force the admin password. Attackers can submit unlimited password guesses without rate limiting, attempt counters, lockouts, or delays to gain full administrator access and modify application configuration.
Articles & Coverage 1
Executive ViewAI
Flame deployments at version 2.4.0 and earlier expose an authentication endpoint that places no limit on password attempts, so anyone with network access to a reachable instance can keep guessing until they obtain full administrator rights over the application and its configuration. Leadership should care because a successful takeover allows an attacker to alter application settings and, depending on how Flame is integrated, pivot into connected business systems. The realistic risk window is concentrated on internet- or broadly reachable instances that still use weak or default-style administrator passwords, while instances kept behind a VPN, an authenticating proxy, or on isolated networks are not remotely reachable.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network reachability to trusted networks, VPN, or an authenticating reverse proxy; enforce long, unique, high-entropy administrator passwords and remove default credentials; apply WAF or edge rate limiting, attempt counters, and temporary lockouts on the /api/auth endpoint; monitor and alert on repeated failed-login patterns and source-IP spraying; and segment or isolate instances that cannot be protected at the edge.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Remote code execution in n8n's workflow expression evaluation system allows an authenticated user with workflow creation
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Exploit-DB